The vulnerability in OpenEMR allows authenticated users who lack formal billing or claims workflow permissions to retrieve billing claim metadata through a dedicated AJAX endpoint. Because the endpoint does not enforce the same access‑control lists (ACLs) as the main billing and claims interface, an attacker can gain read‑only visibility to claim IDs, payer information, and transmission logs. This represents an unauthorized data disclosure and is identified as a CWE‑862 "Missing Authorization in Sensitive Functionality" weakness. The impact is the loss of confidentiality for claim information, potentially exposing protected health information to non‑privileged users.

The flaw exists in OpenEMR versions prior to 8.0.0.1. The affected product is OpenEMR from the vendor openemr. Any instance running a version earlier than 8.0.0.1 is vulnerable; upgrading to 8.0.0.1 or later secures the endpoint and restores proper ACL enforcement.

The CVSS score for this vulnerability is 4.3, indicating a moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further indicating limited known exploitation. Attack vector is authenticated: an attacker must already have legitimate system credentials but no billing privileges. The narrow scope of the data exposed and the need for legitimate authentication reduce the overall risk, yet the confidentiality breach remains a concern for healthcare compliance.